The question of how to combine traffic seen by two physical network interfaces into a single virtual interface is popular on IDS lists I watch. Linux has a channel bonding page at Sourceforge. I devote an entire chapter of my book on how to get access to traffic on the wire, with instructions for SPAN ports, inline bridging devices, and the like. Below is the script I use to create a ngeth0 interface using the FreeBSD ng_eth netgraph node: Linux has an entire page on channel bonding.”]
Source: https://taosecurity.blogspot.com/2004/04/interface-bonding-on-freebsd-question.html